KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammad Al Awadhi and Liana Rashid, GLA & Company
Duties of the Licensee upon users’ request of cancellation of service Under Article 4, the Licensee must facilitate the mechanisms or procedures for such cancellation of service. The Licensee may bind the subscrib - er with a minimum limit of the service contract term, unless this is approved by the authority. Upon the subscriber’s request to cancel the ser - vice, the Licensee must verify the identity of the subscriber applying for cancellation. Dealing with data Under Article 6, Licensees must adhere to the following requirements. • Making no collection, use or disclosure of any personal information related to the user without their official approval. • Not requiring information that is irrelevant in the context of providing services. • Obtaining the approval of the user before dis - closing their information to other parties. • Taking all security measures with regard to: (a) protection of the user’s information; and (b) protection against the loss, damage or disclosure of such information (or its replacement with any untrue data). Under Articles 2 and 4 of the DPPR, Licensees must secure user consent prior to collecting and processing their personal data, and must specify the purpose for data collection and processing both before and during the provision of services, as well as after the termination of services. Data protection In accordance with Article 5(1-3) of the DPPR, Licensees are required to implement robust measures for safeguarding data from unau - thorised access, loss, destruction or damage, DPPR Consent
with protective measures to include encryption, confidentiality practices and disaster recovery protocols. Under Article 6 of the DPPR, Licensees must inform both the data subject and CITRA in the case of a personal data breach. Data subject rights Under Article 4(3), Licensees must disclose their identity, location and contact information to their users, ensuring that users can readily recognise and reach out to them when required. Under Article 4(10), users must also be given the right to withdraw consent or to entirely delete their personal information from the Licensee’s records. Under Article 4(11), Licensees are also obliged to notify data subjects if their personal data is to be transferred outside Kuwait. Under Article 4(12), Licensees must afford their users the right to access or modify stored per - sonal data that is in their possession and is stored with them. CITRA Cloud Service Providers: Regulations and Commitments Types of information collected by cloud service providers (CSPs) Pursuant to the regulations concerning PaaS and SaaS model providers in Article 2, the types of information that a CSP may obtain from users can include (and is not limited to): • name and email address; • address; • payment information; • internet protocol address (“IP address”); and • device and browser information.
278 CHAMBERS.COM
Powered by FlippingBook